Type Alias OIDCOptions<TIdentity, TRequestData>

Permit non-HTTPS issuer and protocol endpoints for local development only.

Runs immediately before a login or refreshed session is persisted. Returning a session replaces the one that gets persisted and handed back to the caller (handleCallback's result, getSession's result); returning void keeps it unchanged. Use this to enrich or provision application data — e.g. upsert a user row — before the session is written, rather than after via a route's own callback hook.

Creates the browser-safe session from persisted authentication and request-only application data. Runs only when a public session is requested.

Controls retries for the initial (uncached) discovery document fetch, so a slow-starting identity provider — e.g. a 503 while it boots, or a connection error before its listener is up — doesn't fail every request until one happens to land after it's ready. Only network errors, 429, and 5xx responses are retried; 4xx responses and local validation failures (issuer mismatch, malformed URLs) fail immediately. Defaults to 5 attempts, starting at 500ms and doubling up to 5000ms.

Custom fetch implementation used for all OIDC network calls (discovery, token, userinfo, JWKS). Useful in dev to work around self-signed certs via a custom https.Agent — do not disable TLS verification in production.

Accepted ID-token signing algorithms. Defaults to the provider metadata, or RS256 when absent.

Loads application-owned data once for each authenticated request handled by handle. The result is exposed as event.locals.oidc.data and is never persisted in the OIDC session.

Maximum serialized cookie size before failing with guidance to use sessionStore. Defaults to 3800 bytes.

Once a discovery document has been fetched successfully, how often to refresh it in the background (stale-while-revalidate). The cached document keeps serving requests while a refresh is attempted or in-flight; a failed refresh is logged and retried after discoveryRetry.maxDelayMs, without disturbing the cache. Defaults to 3600 (1 hour). Set to 0 to disable background refresh.

Use a shared implementation in multi-instance deployments with rotating refresh tokens.

Resolves application identity after provider data validation on login and refresh.

Maximum lifetime of a local browser session. Defaults to 8 hours.

Maximum lifetime of the short-lived cookie that carries CSRF state, the PKCE verifier, and the OIDC nonce across the redirect to the provider and back. Defaults to 10 minutes.

If this expires or the browser drops it before the provider redirects back, handleCallback restarts login. The original returnTo survives because it also travels encrypted inside the state query parameter (see encodeOAuthState/decodeOAuthState in utils.ts). Each authorization transaction has its own cookie, so separate tabs do not overwrite one another's state.

Additional audiences trusted in a multi-audience ID token.